GOPAX suspends crypto deposits, withdrawals and trading, moves all crypto to cold storage

South Korean won-based crypto exchange GOPAX suspended crypto deposits, withdrawals and trading in stages on the afternoon of Nov. 6. In its notice, the company called the move "a preemptive measure to protect user assets and strengthen security, following the recommendation of financial authorities," and said it would transfer all crypto it holds to cold wallets, which are kept offline. The notice did not say when services would resume.

Deposits stopped at 2:55 p.m., trading at 3:53 p.m.

GOPAX posted its first notice at 2:49 p.m. KST, halting crypto deposits from 2:55 p.m. and shutting the standard withdrawal function on its website and app. The same notice said trading would also be suspended soon, and trading stopped at 3:53 p.m. A second notice posted at 4:17 p.m. said all open orders had been canceled.

Both notices cited "a series of recent information leaks and hacking incidents at financial companies" as the reason. The last bitcoin trade on GOPAX's Korean won market before the halt was at 3:09 p.m., at 102.6 million won. At 8:30 p.m. the same day, bitcoin traded at around 103.43 million won on Upbit.

A hacking threat by email, no losses so far

The notices did not mention it, but Edaily and Kyunghyang Shinmun reported that the move came after GOPAX received an email threatening a hack. Edaily said no asset losses had been confirmed so far, and Kyunghyang Shinmun reported that a GOPAX representative said no hack or attempted theft had occurred at that point (as cited by Cointelegraph). It is not known who sent the threat or whether any payment was demanded.

GOPAX was launched by Streami in November 2017, and Binance became its largest shareholder after buying a stake in the operator in 2023. Cointelegraph, citing Financial Supervisory Service (FSS) data, reported that GOPAX held 80.54% of user assets in cold wallets at the end of September. South Korea's Virtual Asset User Protection Act requires exchanges to keep at least 80% of customer crypto assets in cold wallets.

What the FSC asked for after the Binance breach

The move came a week after a major hack at Binance, GOPAX's largest shareholder. In an explanatory statement on Nov. 3, the Financial Services Commission (FSC) said the Binance hack occurred on Oct. 30 Korean time, and that it held an emergency review meeting at 10 a.m. on Nov. 2 with the FSS, the Financial Security Institute, the Digital Asset eXchange Alliance (DAXA, the joint body of Korean exchanges) and major crypto businesses. The FSC made four immediate requests at the meeting: raise the share of cold-wallet holdings, monitor deposits and withdrawals around the clock and secure more response staff, maintain a rapid response system for reporting and sharing information on suspicious access attempts, and set aside additional reserves.

Operator Streami named in last month's breach list

This is not the first time GOPAX has faced scrutiny over security issues. On Oct. 14, the FSC and the FSS announced a sweeping overhaul of security management in the financial sector, saying self-inspections at 555 financial companies through Oct. 8 had found shortcomings at 130 of them. They said breaches had been confirmed at 16 financial companies around the time of incidents at major commercial banks, with about 100,000 records leaked. Korean outlet Toyo Gyeongje, citing the FSC, reported that GOPAX operator Streami and another crypto exchange, Prabang, were on that breach list. The authorities also announced follow-up steps that day, including a full review of financial companies' security systems and stronger accountability for chief executives.

Prabang suspended services on Oct. 24 after detecting abnormal withdrawals from its hot wallet, which is connected to the internet. Cointelegraph, citing Yonhap News Agency, reported that losses were about 100 million won and that Prabang would compensate affected customers with company funds.